From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 15 Jul 2024 08:41:11 +0000 (+0200)
Subject: 5.15-stable patches
X-Git-Tag: v4.19.318~78
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f6867a7aaae12bb7b5c5ed0804f6c24c0e60dfd7;p=thirdparty%2Fkernel%2Fstable-queue.git

5.15-stable patches

added patches:
	tcp-use-signed-arithmetic-in-tcp_rtx_probe0_timed_out.patch
---

diff --git a/queue-5.15/series b/queue-5.15/series
index b7221c3a8b8..6dd6e36369e 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -101,3 +101,4 @@ octeontx2-af-fix-detection-of-ip-layer.patch
 octeontx2-af-extend-rss-supported-offload-types.patch
 octeontx2-af-fix-issue-with-ipv6-ext-match-for-rss.patch
 octeontx2-af-fix-issue-with-ipv4-match-for-rss.patch
+tcp-use-signed-arithmetic-in-tcp_rtx_probe0_timed_out.patch
diff --git a/queue-5.15/tcp-use-signed-arithmetic-in-tcp_rtx_probe0_timed_out.patch b/queue-5.15/tcp-use-signed-arithmetic-in-tcp_rtx_probe0_timed_out.patch
new file mode 100644
index 00000000000..97b45c394e8
--- /dev/null
+++ b/queue-5.15/tcp-use-signed-arithmetic-in-tcp_rtx_probe0_timed_out.patch
@@ -0,0 +1,51 @@
+From 36534d3c54537bf098224a32dc31397793d4594d Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 7 Jun 2024 12:56:52 +0000
+Subject: tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 36534d3c54537bf098224a32dc31397793d4594d upstream.
+
+Due to timer wheel implementation, a timer will usually fire
+after its schedule.
+
+For instance, for HZ=1000, a timeout between 512ms and 4s
+has a granularity of 64ms.
+For this range of values, the extra delay could be up to 63ms.
+
+For TCP, this means that tp->rcv_tstamp may be after
+inet_csk(sk)->icsk_timeout whenever the timer interrupt
+finally triggers, if one packet came during the extra delay.
+
+We need to make sure tcp_rtx_probe0_timed_out() handles this case.
+
+Fixes: e89688e3e978 ("net: tcp: fix unexcepted socket die when snd_wnd is 0")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Menglong Dong <imagedong@tencent.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Link: https://lore.kernel.org/r/20240607125652.1472540-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_timer.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -442,8 +442,13 @@ static bool tcp_rtx_probe0_timed_out(con
+ {
+ 	const struct tcp_sock *tp = tcp_sk(sk);
+ 	const int timeout = TCP_RTO_MAX * 2;
+-	u32 rcv_delta, rtx_delta;
++	u32 rtx_delta;
++	s32 rcv_delta;
+ 
++	/* Note: timer interrupt might have been delayed by at least one jiffy,
++	 * and tp->rcv_tstamp might very well have been written recently.
++	 * rcv_delta can thus be negative.
++	 */
+ 	rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp;
+ 	if (rcv_delta <= timeout)
+ 		return false;